[FIX] web: provide correct autofill browser hints

Modern browser implement the autofill specs as described at
 https://html.spec.whatwg.org/multipage/forms.html#autofill

This means that there is now a way to tell the browser when a password
field is supposed to be filled with the user's own password (e.g. on a
login field), and when it's supposed to be used to input a new secret
value (e.g. when changing someone else's password).

This can be distinguished by setting the autocomplete attribute
to `current-password` or `new-password`.

In addition, many browsers have decided to entirely disregard the
autocomplete='off' attribute value, because it is felt that using
a secure password manager (as provided by those browsers) is a net
gain for security, allowing users to pick stron passwords.
See also https://developer.mozilla.org/en-US/docs/Web/Security/Securing_your_site/Turning_off_form_autocompletion

Based on this, the framework should generally consider that
password fields in the backend are meant to be used for *setting*
new values (autocomplete="new-password", i.e. no autocompletion!),
whereas the password field on the login page can indeed be autofilled
with the user's current password (autocomplete="current-password").

In addition to making the above changes, this patch also
lets developer specify their own `autocomplete` attribute on
text input fields.

0 files changed, 0 insertions, 0 deletions